General

  • Target

    424b1800061eb3534756eada61219882687a8f99d206d300ba7e4696066aaac8

  • Size

    1009KB

  • Sample

    210922-qk4vmsfcfn

  • MD5

    dd50c188aabc9e550fc221de015ddb55

  • SHA1

    068aa881159f72c4454f44f32fb754fc5b88f688

  • SHA256

    424b1800061eb3534756eada61219882687a8f99d206d300ba7e4696066aaac8

  • SHA512

    b63b109c27987c3b873c378707eb983c60b782e7e9a2ec0dafac7130ef17da0c034698aaa025cd6103cc5ba6e6fb4e13240a20c773fb2e7a981eef276e406b36

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Limebot3

C2

microsoftdnsbug.duckdns.org:6699

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    luffy

Targets

    • Target

      424b1800061eb3534756eada61219882687a8f99d206d300ba7e4696066aaac8

    • Size

      1009KB

    • MD5

      dd50c188aabc9e550fc221de015ddb55

    • SHA1

      068aa881159f72c4454f44f32fb754fc5b88f688

    • SHA256

      424b1800061eb3534756eada61219882687a8f99d206d300ba7e4696066aaac8

    • SHA512

      b63b109c27987c3b873c378707eb983c60b782e7e9a2ec0dafac7130ef17da0c034698aaa025cd6103cc5ba6e6fb4e13240a20c773fb2e7a981eef276e406b36

    Score
    10/10
    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

MITRE ATT&CK Enterprise v6

Tasks